Security Resilience

Threat actor · all actors

EquationG0020 state

🇺🇸 US · NSA · TAO

aka Equation, Equation Group, Tilded Team, EQGRP, G0020

Last updated: 2026-10-16

36attributed CVEs
7ATT&CK techniques
90.4IDF score (tooling uniqueness)
1exclusive CVEs
2010–2024years active

About this actor

[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. (Citation: Kaspersky Equation QA)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0020

Unclassifiedno scheme matched

EquationEquation GroupTilded TeamEQGRP

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 7 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2010: 1 CVE published120102012: 1 CVE published120122013: 1 CVE published120132017: 1 CVE published120172018: 1 CVE published120182019: 7 CVE published720192020: 7 CVE published720202021: 16 CVE published2021: 29 KEV added4520212022: 4 KEV added420222024: 1 CVE published2024: 1 KEV added22024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2021-22893 KEV10.010.00.97002021-04-23see CVE
CVE-2024-1709 KEV10.010.00.99982024-02-21see CVE
CVE-2018-7600 KEV9.99.81.00002018-03-29see CVE
CVE-2019-0604 KEV9.99.80.99912019-03-05see CVE
CVE-2019-11580 KEV9.99.80.97502019-06-03see CVE
CVE-2019-18935 KEV9.99.80.99742019-12-11see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-3396 KEV9.99.80.99912019-03-25see CVE
CVE-2020-12812 KEV9.99.80.49342020-07-24see CVE
CVE-2020-15505 KEV9.99.80.99742020-07-07see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2021-21985 KEV9.99.81.00002021-05-26see CVE
CVE-2021-27101 KEV9.99.80.06002021-02-16see CVE
CVE-2021-27103 KEV9.99.80.11412021-02-16see CVE
CVE-2021-27104 KEV9.99.80.56692021-02-16see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2021-22894 KEV9.28.80.50622021-05-27see CVE
CVE-2021-22899 KEV9.28.80.38002021-05-27see CVE
CVE-2021-34527 KEV9.28.80.99792021-07-02see CVE
CVE-2013-3894 8.78.10.93122013-10-09see CVE
CVE-2010-2568 KEV8.57.80.97342010-07-22see CVE
CVE-2017-11882 KEV8.57.80.99942017-11-15see CVE
CVE-2020-0787 KEV8.57.80.91412020-03-12see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2021-27102 KEV8.57.80.03652021-02-16see CVE
CVE-2021-42278 KEV8.37.50.97172021-11-10see CVE
CVE-2021-42287 KEV8.37.50.97192021-11-10see CVE
CVE-2021-22900 KEV8.17.20.14152021-05-27see CVE
CVE-2012-0159 8.00.00.85682012-05-09see CVE
CVE-2019-5591 KEV7.76.50.56822020-08-14see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
AC-21 / 714%
AC-31 / 714%
AC-51 / 714%
AC-61 / 714%
CM-21 / 714%
CM-31 / 714%
CM-51 / 714%
CM-61 / 714%
CM-81 / 714%
IA-21 / 714%
IA-71 / 714%
IA-81 / 714%
RA-91 / 714%
SA-101 / 714%
SA-111 / 714%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category